rule win_mirai_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.mirai."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirai"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 8365fc00 8b45ec 83c801 8945ec 8b4508 8b4df4 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8365fc00             | and                 dword ptr [ebp - 4], 0
            //   8b45ec               | mov                 eax, dword ptr [ebp - 0x14]
            //   83c801               | or                  eax, 1
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]

        $sequence_1 = { 8d957cf8ffff e8???????? 83c418 33c9 33c0 8b9405fcfbffff 0394057cfbffff }
            // n = 7, score = 100
            //   8d957cf8ffff         | lea                 edx, [ebp - 0x784]
            //   e8????????           |                     
            //   83c418               | add                 esp, 0x18
            //   33c9                 | xor                 ecx, ecx
            //   33c0                 | xor                 eax, eax
            //   8b9405fcfbffff       | mov                 edx, dword ptr [ebp + eax - 0x404]
            //   0394057cfbffff       | add                 edx, dword ptr [ebp + eax - 0x484]

        $sequence_2 = { eb02 33f6 57 e8???????? 53 e8???????? 8b8df4feffff }
            // n = 7, score = 100
            //   eb02                 | jmp                 4
            //   33f6                 | xor                 esi, esi
            //   57                   | push                edi
            //   e8????????           |                     
            //   53                   | push                ebx
            //   e8????????           |                     
            //   8b8df4feffff         | mov                 ecx, dword ptr [ebp - 0x10c]

        $sequence_3 = { a1???????? 33c4 89842490060000 8b8c249c060000 8b842498060000 56 8bb424a4060000 }
            // n = 7, score = 100
            //   a1????????           |                     
            //   33c4                 | xor                 eax, esp
            //   89842490060000       | mov                 dword ptr [esp + 0x690], eax
            //   8b8c249c060000       | mov                 ecx, dword ptr [esp + 0x69c]
            //   8b842498060000       | mov                 eax, dword ptr [esp + 0x698]
            //   56                   | push                esi
            //   8bb424a4060000       | mov                 esi, dword ptr [esp + 0x6a4]

        $sequence_4 = { 8b968c040000 57 894218 e8???????? 8bd8 689f010000 895dfc }
            // n = 7, score = 100
            //   8b968c040000         | mov                 edx, dword ptr [esi + 0x48c]
            //   57                   | push                edi
            //   894218               | mov                 dword ptr [edx + 0x18], eax
            //   e8????????           |                     
            //   8bd8                 | mov                 ebx, eax
            //   689f010000           | push                0x19f
            //   895dfc               | mov                 dword ptr [ebp - 4], ebx

        $sequence_5 = { 8bb40df4feffff 8bd6 2bd3 c1ea1f 8bfa c1e708 2bfb }
            // n = 7, score = 100
            //   8bb40df4feffff       | mov                 esi, dword ptr [ebp + ecx - 0x10c]
            //   8bd6                 | mov                 edx, esi
            //   2bd3                 | sub                 edx, ebx
            //   c1ea1f               | shr                 edx, 0x1f
            //   8bfa                 | mov                 edi, edx
            //   c1e708               | shl                 edi, 8
            //   2bfb                 | sub                 edi, ebx

        $sequence_6 = { b001 eb22 0fb64508 83f83a 740f 0fb64508 83f85f }
            // n = 7, score = 100
            //   b001                 | mov                 al, 1
            //   eb22                 | jmp                 0x24
            //   0fb64508             | movzx               eax, byte ptr [ebp + 8]
            //   83f83a               | cmp                 eax, 0x3a
            //   740f                 | je                  0x11
            //   0fb64508             | movzx               eax, byte ptr [ebp + 8]
            //   83f85f               | cmp                 eax, 0x5f

        $sequence_7 = { c9 c3 55 8bec 51 894dfc 837d0c01 }
            // n = 7, score = 100
            //   c9                   | leave               
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx
            //   837d0c01             | cmp                 dword ptr [ebp + 0xc], 1

        $sequence_8 = { 8b4dfc 52 50 51 68???????? 68???????? 6a02 }
            // n = 7, score = 100
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   52                   | push                edx
            //   50                   | push                eax
            //   51                   | push                ecx
            //   68????????           |                     
            //   68????????           |                     
            //   6a02                 | push                2

        $sequence_9 = { 8d4c244c e8???????? 85ff 75e3 8b442460 85c0 7504 }
            // n = 7, score = 100
            //   8d4c244c             | lea                 ecx, [esp + 0x4c]
            //   e8????????           |                     
            //   85ff                 | test                edi, edi
            //   75e3                 | jne                 0xffffffe5
            //   8b442460             | mov                 eax, dword ptr [esp + 0x60]
            //   85c0                 | test                eax, eax
            //   7504                 | jne                 6

    condition:
        7 of them and filesize < 7086080
}